another newbie question
carter at qosient.com
Tue Jan 20 12:39:12 EST 2004
Kevin is right, argus-clients do not use tcpdump's filter.
Don't use '!', unless you escape it, as most shells use it
as a history char.
So, your network filters are not quite right, and they are
net 192.168.10.0 mask 255.255.0.0
net 192.168.0.0 mask 255.255.0.0
net 192.168.1.0 mask 255.255.0.0
The way it works is that the filter takes the address to
be tested, applies the mask, and then compares the result to
the network address provided. So, the first and third filters
will never match, as the third octet will be obliterated
by the mask, and the result will not equal the provided
Try a CIDR address or if it's a classic C/B/A address, you
can put just the network number.
ramon [options] - dst net 192.168.0.192/26 and not net 192.168.10
From: owner-argus-info at lists.andrew.cmu.edu
[mailto:owner-argus-info at lists.andrew.cmu.edu] On Behalf Of Kevin C Miller
Sent: Tuesday, January 20, 2004 12:06 PM
To: Furnish, Trever G; Argus List (E-mail)
Subject: Re: another newbie question
It's just the BPF language that tcpdump and others use.
I would use 'not' instead of '!', e.g. "dst net 192.168.0.64 mask
255.255.0.192 and not net 192.168.1.0 mask 255.255.0.0"
Also, 255.255.0.192 isn't a valid netmask. Do you mean 255.255.255.192 ?
--On Tuesday, January 20, 2004 11:58 AM -0500 "Furnish, Trever G"
<TGFurnish at herff-jones.com> wrote:
> [root at enterprise u01]# ramon -M Matrix -n -L0 -r /u01/argus.log - dst net
> 192.168.0.64 mask 255.255.0.192 and ! net 192.168.1.0 mask 255.255.0.0 |
> wc -l
Kevin C. Miller <kcm at cmu.edu>
Carnegie Mellon University
More information about the argus